6129 matches found
Modoer review system admin.php cross-site script execution vulnerability
Modoer review system a professional review website system, a variety of industry reviews, you can freely regulate the type of review project. Modoer system version 20150505 cross-site scripting vulnerability exists in the background, due to the failure to limit the act parameters when loading...
LocalTapiola: Open redirection protection bypass (/cs/Satellite)
Issue The reporter found a vulnerability that allowed open and unvalidated redirects. Fix A fix was issued for the application. Reasoning "Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to...
Cisco WebEx Meetings Player Remote Code Execution Vulnerability
Cisco WebEx Meetings are web conferencing solutions. A security vulnerability exists in Cisco WebEx Meetings Player due to the program not properly validating user-supplied files. An unauthenticated remote user could exploit this vulnerability to execute arbitrary code with user privileges...
macOS < 10.11.5 Multiple Vulnerabilities
Binary data 802004.prm...
DEBIAN-CVE-2016-6187
The apparmorsetprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook...
Spoofing attack due to unvalidated KDC
Overview Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed...
CVE-2016-2508
media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate certain track data, which allows remote attackers to execute arbitrary code or cause a denial of service memory...
Code injection
drivers/video/msm/mdss/mdp3ctrl.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5, 5X, and 6P devices does not validate start and length values, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28602014 and Qualcomm internal bug...
Code injection
The 1 alloc and 2 free APIs in arch/arm/mach-msm/qdsp6v2/msmaudioion.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices do not validate parameters, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28749392 and Qualcomm interna...
The vulnerability of the Internet Explorer browser, which allows a malicious individual to execute arbitrary code or trigger a service failure.
Internet Explorer contains a vulnerability in the CFormatCache::AddRefData function, which is related to the lack of validation of data entered by users. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code...
Apache Struts vulnerable to validation bypass in Getter method
Overview Apache Struts provided by the Apache Software Foundation is a software framework for creating web applications in Java. Web applications that are developed using Apache Struts 2 contain a validation bypass in Getter method vulnerability. JPCERT/CC Addendum Update: August 25, 2016...
XLware LibXL Denial of Service Vulnerability
XLware LibXL is a set of tools developed by the Ukrainian company XLware for direct manipulation of excel documents using the C/C++ language. A security vulnerability exists in XLware LibXL that originates from the device failing to validate driver domain input. An attacker could exploit the...
Zomato: Unvalidated redirect on user profile website
The user profile redirect request is not properly validated. The presence of parameter t which is being passed through the request is verified but same value can be reused to any unauthenticated or authenticated user to redirect them to any web site. Sample link is given below...
UBUNTU-CVE-2016-1698
The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition...
IBM UrbanCode Deploy Artifact Download Vulnerability
IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...
LMCMS Backend Arbitrary File Deletion Vulnerability
LMCMS Leming CMS system is a web content management system developed in Java language, developed by Beijing Leming Zhixin Technology Co., Ltd. and distributed under commercial license. LMCMS Leming CMS system management background full media library column under the file management provided in th...
McAfee Email Gateway 7.6.x < 7.6.404 Blocked Email Alert XSS (SB10153)
The version of McAfee Email Gateway MEG installed on the remote host is 7.6.x prior to 7.6.404. It is, therefore, affected by a cross-site scripting XSS vulnerability that is triggered when File Filtering is enabled with the action set to 'ESERVICES:REPLACE'. This is due to a failure to validate...
Joyent Node.js moment denial of service vulnerability
Joyent Node.js is a web application platform built on top of Google's V8 JavaScript engine. A denial of service vulnerability exists in Joyent Node.js moment due to a failure of the moment.duration function to check input, allowing remote attackers to submit special regular expressions for denial...